generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add opaque ID structure.

Browse Source 
Move the IP, email and host checking fields from the public
X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID
structure. By doing this the structure can be modified in future
without risk of breaking any applications.
This commit is contained in:
Dr. Stephen Henson 2013-12-11 14:28:57 +00:00
parent 8c6d8c2a49
commit adc6bd73e3
5 changed files with 138 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/x509/Makefile
View File

@ -33,7 +33,7 @@ LIBOBJ= x509_def.o x509_d2.o x509_r2x.o x509_cmp.o \
SRC= $(LIBSRC)
EXHEADER= x509.h x509_vfy.h
HEADER= $(EXHEADER)
HEADER= $(EXHEADER) vpm_int.h
ALL= $(GENERAL) $(SRC) $(HEADER)

69
crypto/x509/vpm_int.h Normal file
View File

@ -0,0 +1,69 @@
/* vpm_int.h */
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 2013.
*/
/* ====================================================================
* Copyright (c) 2013 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/* internal only structure to hold additional X509_VERIFY_PARAM data */
struct X509_VERIFY_PARAM_ID_st
{
unsigned char *host; /* If not NULL hostname to match */
size_t hostlen;
unsigned char *email; /* If not NULL email address to match */
size_t emaillen;
unsigned char *ip; /* If not NULL IP address to match */
size_t iplen; /* Length of IP address */
};

8
crypto/x509/x509_vfy.c
View File

@ -69,6 +69,7 @@
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
#include "vpm_int.h"
/* CRL score values */
@ -708,18 +709,19 @@ static int check_id_error(X509_STORE_CTX *ctx, int errcode)
static int check_id(X509_STORE_CTX *ctx)
{
X509_VERIFY_PARAM *vpm = ctx->param;
X509_VERIFY_PARAM_ID *id = vpm->id;
X509 *x = ctx->cert;
if (vpm->host && !X509_check_host(x, vpm->host, vpm->hostlen, 0))
if (id->host && !X509_check_host(x, id->host, id->hostlen, 0))
{
if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))
return 0;
}
if (vpm->email && !X509_check_email(x, vpm->email, vpm->emaillen, 0))
if (id->email && !X509_check_email(x, id->email, id->emaillen, 0))
{
if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))
return 0;
}
if (vpm->ip && !X509_check_ip(x, vpm->ip, vpm->iplen, 0))
if (id->ip && !X509_check_ip(x, id->ip, id->iplen, 0))
{
if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))
return 0;

9
crypto/x509/x509_vfy.h
View File

@ -158,6 +158,8 @@ typedef struct x509_lookup_method_st
X509_OBJECT *ret);
} X509_LOOKUP_METHOD;
typedef struct X509_VERIFY_PARAM_ID_st X509_VERIFY_PARAM_ID;
/* This structure hold all parameters associated with a verify operation
* by including an X509_VERIFY_PARAM structure in related structures the
* parameters used can be customized
@ -173,12 +175,7 @@ typedef struct X509_VERIFY_PARAM_st
int trust; /* trust setting to check */
int depth; /* Verify depth */
STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */
unsigned char *host; /* If not NULL hostname to match */
size_t hostlen;
unsigned char *email; /* If not NULL email address to match */
size_t emaillen;
unsigned char *ip; /* If not NULL IP address to match */
size_t iplen; /* Length of IP address */
X509_VERIFY_PARAM_ID *id; /* opaque ID data */
} X509_VERIFY_PARAM;
DECLARE_STACK_OF(X509_VERIFY_PARAM)

87
crypto/x509/x509_vpm.c
View File

@ -65,10 +65,13 @@
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include "vpm_int.h"
/* X509_VERIFY_PARAM functions */
static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
{
X509_VERIFY_PARAM_ID *paramid;
if (!param)
return;
param->name = NULL;
@ -83,31 +86,44 @@ static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
param->policies = NULL;
}
if (param->host)
paramid = param->id;
if (paramid->host)
{
OPENSSL_free(param->host);
param->host = NULL;
param->hostlen = 0;
OPENSSL_free(paramid->host);
paramid->host = NULL;
paramid->hostlen = 0;
}
if (param->email)
if (paramid->email)
{
OPENSSL_free(param->email);
param->email = NULL;
param->emaillen = 0;
OPENSSL_free(paramid->email);
paramid->email = NULL;
paramid->emaillen = 0;
}
if (param->ip)
if (paramid->ip)
{
OPENSSL_free(param->ip);
param->ip = NULL;
param->iplen = 0;
OPENSSL_free(paramid->ip);
paramid->ip = NULL;
paramid->iplen = 0;
}
}
X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
{
X509_VERIFY_PARAM *param;
X509_VERIFY_PARAM_ID *paramid;
param = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));
if (!param)
return NULL;
paramid = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));
if (!paramid)
{
OPENSSL_free(param);
return NULL;
}
memset(param, 0, sizeof(X509_VERIFY_PARAM));
memset(paramid, 0, sizeof(X509_VERIFY_PARAM_ID));
param->id = paramid;
x509_verify_param_zero(param);
return param;
}
@ -115,6 +131,7 @@ X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
{
x509_verify_param_zero(param);
OPENSSL_free(param->id);
OPENSSL_free(param);
}
@ -155,20 +172,27 @@ void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
(to_overwrite || \
((src->field != def) && (to_default || (dest->field == def))))
/* As above but for ID fields */
#define test_x509_verify_param_copy_id(idf, def) \
test_x509_verify_param_copy(id->idf, def)
/* Macro to test and copy a field if necessary */
#define x509_verify_param_copy(field, def) \
if (test_x509_verify_param_copy(field, def)) \
dest->field = src->field
int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
const X509_VERIFY_PARAM *src)
{
unsigned long inh_flags;
int to_default, to_overwrite;
X509_VERIFY_PARAM_ID *id;
if (!src)
return 1;
id = src->id;
inh_flags = dest->inh_flags | src->inh_flags;
if (inh_flags & X509_VP_FLAG_ONCE)
@ -211,21 +235,21 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
return 0;
}
if (test_x509_verify_param_copy(host, NULL))
if (test_x509_verify_param_copy_id(host, NULL))
{
if (!X509_VERIFY_PARAM_set1_host(dest, src->host, src->hostlen))
if (!X509_VERIFY_PARAM_set1_host(dest, id->host, id->hostlen))
return 0;
}
if (test_x509_verify_param_copy(email, NULL))
if (test_x509_verify_param_copy_id(email, NULL))
{
if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen))
if (!X509_VERIFY_PARAM_set1_email(dest, id->email, id->emaillen))
return 0;
}
if (test_x509_verify_param_copy(ip, NULL))
if (test_x509_verify_param_copy_id(ip, NULL))
{
if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen))
if (!X509_VERIFY_PARAM_set1_ip(dest, id->ip, id->iplen))
return 0;
}
@ -374,14 +398,14 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,
const unsigned char *name, size_t namelen)
{
return int_x509_param_set1(&param->host, &param->hostlen,
return int_x509_param_set1(&param->id->host, &param->id->hostlen,
name, namelen);
}
int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
const unsigned char *email, size_t emaillen)
{
return int_x509_param_set1(&param->email, &param->emaillen,
return int_x509_param_set1(&param->id->email, &param->id->emaillen,
email, emaillen);
}
@ -390,7 +414,7 @@ int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,
{
if (iplen != 0 && iplen != 4 && iplen != 16)
return 0;
return int_x509_param_set1(&param->ip, &param->iplen, ip, iplen);
return int_x509_param_set1(&param->id->ip, &param->id->iplen, ip, iplen);
}
int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc)
@ -408,6 +432,10 @@ int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param)
return param->depth;
}
static X509_VERIFY_PARAM_ID _empty_id = {NULL, 0, NULL, 0, NULL, 0};
#define vpm_empty_id (X509_VERIFY_PARAM_ID *)&_empty_id
/* Default verify parameters: these are used for various
* applications and can be overridden by the user specified table.
* NB: the 'name' field *must* be in alphabetical order because it
@ -423,7 +451,8 @@ static const X509_VERIFY_PARAM default_table[] = {
0, /* purpose */
0, /* trust */
100, /* depth */
NULL /* policies */
NULL, /* policies */
vpm_empty_id
},
{
"pkcs7", /* S/MIME sign parameters */
@ -433,7 +462,8 @@ static const X509_VERIFY_PARAM default_table[] = {
X509_PURPOSE_SMIME_SIGN, /* purpose */
X509_TRUST_EMAIL, /* trust */
-1, /* depth */
NULL /* policies */
NULL, /* policies */
vpm_empty_id
},
{
"smime_sign", /* S/MIME sign parameters */
@ -443,7 +473,8 @@ static const X509_VERIFY_PARAM default_table[] = {
X509_PURPOSE_SMIME_SIGN, /* purpose */
X509_TRUST_EMAIL, /* trust */
-1, /* depth */
NULL /* policies */
NULL, /* policies */
vpm_empty_id
},
{
"ssl_client", /* SSL/TLS client parameters */
@ -453,7 +484,8 @@ static const X509_VERIFY_PARAM default_table[] = {
X509_PURPOSE_SSL_CLIENT, /* purpose */
X509_TRUST_SSL_CLIENT, /* trust */
-1, /* depth */
NULL /* policies */
NULL, /* policies */
vpm_empty_id
},
{
"ssl_server", /* SSL/TLS server parameters */
@ -463,7 +495,8 @@ static const X509_VERIFY_PARAM default_table[] = {
X509_PURPOSE_SSL_SERVER, /* purpose */
X509_TRUST_SSL_SERVER, /* trust */
-1, /* depth */
NULL /* policies */
NULL, /* policies */
vpm_empty_id
}};
static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;